Cross-cloud policy management for hybrid cloud deployments

ABSTRACT

A method is provide for managing a migration of a virtual machine from a private data center managed by a first organization to a public cloud computing system by a second organization and where the first organization is a tenant. The configurations of physical infrastructure of the private data center that underlies the virtual machine are determined, along with a corresponding match preference indicating a level of criticality for some corresponding configuration at the public cloud system. The configurations and match preferences generated as part of a migration package. The public cloud computing system instantiates a corresponding VM based on the determined configurations and corresponding match preferences.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application claims the benefit of U.S. Provisional PatentApplication No. 62/063,373, filed Oct. 13, 2014 and also under 35 U.S.C.119(a)-(d) to Foreign application Serial No. 6853/CHE/2014 filed inIndia entitled “CROSS-CLOUD POLICY MANAGEMENT FOR HYBRID CLOUDDEPLOYMENTS”, on Dec. 31, 2014, by VMware, Inc., the entire contents ofwhich are incorporated by reference herein.

BACKGROUND

Cloud architectures are used in cloud computing and cloud storagesystems for offering infrastructure-as-a-service (IaaS) cloud services.Examples of cloud architectures include the VMware vCloud™ Directorcloud architecture software, Amazon EC2™ web service, and OpenStack™open source cloud computing service, IaaS cloud service is a type ofcloud service that provides access to physical a and/or virtualresources in a cloud environment. These services provide a tenantapplication programming interface (API) that supports operations formanipulating IaaS constructs such as virtual machines (VMs) and logicalnetworks. However, the use of such public cloud services is typicallykept separate from the use of existing computing resources in datacenters managed by an enterprise.

SUMMARY

Embodiments of the present disclosure provide a method for managing ahybrid cloud computing system. The method includes receiving a requestto migrate a virtual machine from a private data center managed by afirst organization to a public cloud computing system. The firstorganization is a tenant in the public cloud computing system managed bya second organization. The method further includes determiningconfigurations of physical infrastructure of the private data centerthat underlies the virtual machine, and determining a match preferenceassociated with each of the configurations. The match preferencesindicate a level of criticality for some corresponding configuration atthe public cloud system. The method includes transmitting, to the publiccloud computing system, a migration package associated with the virtualmachine and specifying the determined configurations and correspondingmatch preferences.

Another embodiment of the present disclosure provides a non-transitorycomputer-readable storage medium comprising instructions that, whenexecuted in a computing device, manage a hybrid cloud computing system,by performing the steps of receiving a request to migrate a virtualmachine from a private data center managed by a first organization to apublic cloud computing system, wherein the first organization is atenant in the public cloud computing system managed by a secondorganization. The steps include determining configurations of physicalinfrastructure of the private data center that underlies the virtualmachine, and determining a match preference associated with each of theconfigurations. The match preferences indicate a level of criticalityfor some corresponding configuration at the public cloud system. Thesteps further include transmitting, to the public cloud computingsystem, a migration package associated with the virtual machine andspecifying the determined configurations and corresponding matchpreferences.

Another embodiments of the present disclosure provides a method formanaging a hybrid cloud computing system. The method includes receiving,at a public cloud computing system, a migration package associated witha first virtual machine at a private data center managed by a firstorganization. The first organization is a tenant in the public cloudcomputing system managed by a second organization. The method furtherincludes retrieving a plurality of configurations and correspondingmatch preferences from the migration package. The match preferencesindicate a level of criticality for some corresponding configuration atthe public cloud system. The method includes, responsive to determiningavailability for the plurality of configurations at the public cloudcomputing system based on the corresponding match preferences,instantiating a second virtual machine based on the migration package.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram that illustrates a computer system in whichone or more embodiments may be utilized.

FIG. 2 is a block diagram depicting cross-cloud deployment operations ofa hybrid cloud computing system, according to one embodiment of thepresent disclosure.

FIG. 3 is a flow diagram depicting a method for managing a hybrid cloudcomputing system, according to one embodiment of the present disclosure.

To facilitate understanding, identical reference numerals have beenused, where possible, to designate identical elements that are common tothe figures. It is contemplated that elements disclosed in oneembodiment may be beneficially utilized on other embodiments withoutspecific recitation.

DETAILED DESCRIPTION

FIG. 1 is a block diagram of a hybrid cloud computing system 100 inwhich one or more embodiments of the present disclosure may be utilized.Hybrid cloud computing system 100 includes a virtualized computingsystem 102 and a cloud computing system 150, and is configured toprovide a common platform for managing and executing virtual workloadsseamlessly between virtualized computing system 102 and cloud computingsystem 150. In one embodiment, virtualized computing system 102 may be adata center controlled and administrated by a particular enterprise orbusiness organization, while cloud computing system 150 is operated by acloud computing service provider and exposed as a service available toaccount holders, such as the particular enterprise in addition to otherenterprises. As such virtualized computing system 102 may sometimes bereferred to as an on-premise data center(s), and cloud computing system150 may be referred to as a “public” cloud service. In some embodiments,virtualized computing system 102 itself may be configured as a privatecloud service provided by the enterprise.

As used herein, an internal cloud or “private” cloud is a cloud in whicha tenant and a cloud service provider are part of the same organization,while an external or “public” cloud is a cloud that is provided by anorganization that is separate from a tenant that accesses the externalcloud. For example, the tenant may be part of an enterprise, and theexternal cloud may be part of a cloud service provider that is separatefrom the enterprise of the tenant and that provides cloud services todifferent enterprises and/or individuals. In embodiments disclosedherein, a hybrid cloud is a cloud architecture in which a tenant isprovided with seamless access to both private cloud resources and publiccloud resources.

Virtualized computing system 102 includes one or more host computersystems 104. Hosts 104 may be constructed on a server grade hardwareplatform 106, such as an x86 architecture platform, a desktop, and alaptop. As shown, hardware platform 106 of each host 104 may includeconventional components of a computing device, such as one or moreprocessors (CPUs) 108, system memory 110, a network interface 112,storage 114, and other I/O devices such as, for example, a mouse andkeyboard (not shown). Processor 108 is configured to executeinstructions, for example, executable instructions that perform one ormore operations described herein and may be stored in memory 110 and inlocal storage. Memory 110 is a device allowing information, such asexecutable instructions, cryptographic keys, virtual disks,configurations, and other data, to be stored and retrieved. Memory 110may include, for example, one or more random access memory (RAM)modules. Network interface 112 enables host 104 to communicate withanother device via a communication medium, such as a network 122 withinvirtualized computing system 102. Network interface 112 may be one ormore network adapters, also referred to as a Network Interface Card(NIC). Storage 114 represents local storage devices (e.g., one or morehard disks, flash memory modules, solid state disks, and optical disks)and/or a storage interface that enables host 104 to communicate with oneor more network data storage systems. Examples of a storage interfaceare a host bus adapter (HBA) that couples host 104 to one or morestorage arrays, such as a storage area network (SAN) or anetwork-attached storage (NAS), as well as other network data storagesystems.

Each host 104 is configured to provide a virtualization layer thatabstracts processor, memory, storage, and networking resources ofhardware platform 106 into multiple virtual machines 120 ₁ to 120 _(N)(collectively referred to as VMs 120) that run concurrently on the samehosts. VMs 120 run on top of a software interface layer, referred toherein as a hypervisor 116, that enables sharing of the hardwareresources of host 104 by VMs 120. One example of hypervisor 116 that maybe used in an embodiment described herein is a VMware ESXi hypervisorprovided as part of the VMware vSphere solution made commerciallyavailable from VMware, Inc. Hypervisor 116 may run on top of theoperating system of host 104 or directly on hardware components of host104.

Virtualized computing system 102 includes a virtualization managementmodule (depicted in FIG. 1 as virtualization manager 130) that maycommunicate to the plurality of hosts 104 via a network, sometimesreferred to as a management network 126. In one embodiment,virtualization manager 130 is a computer program that resides andexecutes in a central server, which may reside in virtualized computingsystem 102, or alternatively, running as a VM in one of hosts 104. Oneexample of a virtualization management module is the vCenter® Serverproduct made available from VMware, Inc. Virtualization manager 130 isconfigured to carry out administrative tasks for computing system 102,including managing hosts 104, managing VMs 120 running within each host104, provisioning VMs, migrating VMs from one host to another host, andload balancing between hosts 104.

In one embodiment, virtualization manager 130 includes a hybrid cloudmanagement module (depicted as hybrid cloud manager 132) configured tomanage and integrate virtual computing resources provided by cloudcomputing system 150 with virtual computing resources of computingsystem 102 to form a unified “hybrid” computing platform. Hybrid cloudmanager 132 is configured to deploy VMs in cloud computing system 150,transfer VMs from virtualized computing system 102 to cloud computingsystem 150, and perform other “cross-cloud” administrative task, asdescribed in greater detail later. In one implementation, hybrid cloudmanager 132 is a module or plug-in complement to virtualization manager130, although other implementations may be used, such as a separatecomputer program executing, in a central server or running in a VM inone of hosts 104.

In one embodiment, hybrid cloud manager 132 is configured to controlnetwork traffic into network 122 via a gateway component (depicted as agateway 124). Gateway 124 (e.g., executing as a virtual appliance) isconfigured to provide VMs 120 and other components in virtualizedcomputing system 102 with connectivity to an external network 140 (e.g.,Internet). Gateway 124 may manage external public IP addresses for VMs120 and route traffic incoming to and outgoing from virtualizedcomputing system 102 and provide networking services, such as firewalls,network address translation (NAT), dynamic host configuration protocol(DHCP), load balancing, and virtual private network (VPN) connectivityover a network 140.

In one or more embodiments, cloud computing system 150 is configured todynamically provide an enterprise (or users of an enterprise) with oneor more virtual data centers 180 in which a user may provision VMs 120,deploy multi-tier applications on VMs 120, and/or execute workloads.Cloud computing system 150 includes an infrastructure platform 154 uponwhich a cloud computing environment 170 may be executed. In theparticular embodiment of FIG. 1, infrastructure platform 154 includeshardware resources 160 having computing resources (e.g., hosts 162 ₁ to162 _(N)), storage resources (e.g., one or more storage array systems,such as SAN 164), and networking resources, which are configured in amanner to provide a virtualization environment 156 that supports theexecution of a plurality of virtual machines 172 across hosts 162. It isrecognized that hardware resources 160 of cloud computing system 150 mayin fact be distributed across multiple data centers in differentlocations.

Each cloud computing environment 170 is associated with a particulartenant of cloud computing system 150, such as the enterprise providingvirtualized computing system 102. In one embodiment, cloud computingenvironment 170 may be configured as a dedicated cloud service for asingle tenant comprised of dedicated hardware resources 160 (i.e.,physically isolated from hardware resources used by other users of cloudcomputing system 150). In other embodiments, cloud computing environment170 may be configured as part of a multi-tenant cloud service withlogically isolated virtual computing resources on a shared physicalinfrastructure. As shown in FIG. 1, cloud computing system 150 maysupport multiple cloud computing environments 170, available to multipleenterprises in single-tenant and multi-tenant configurations.

In one embodiment, virtualization environment 156 includes anorchestration component 158 (e.g., implemented as a process running in aVM) that provides infrastructure resources to cloud computingenvironment 170 responsive to provisioning requests. For example, ifenterprise required a specified number of virtual machines to deploy aweb applications or to modify scale) a currently running web applicationto support peak demands, orchestration component 158 can initiate andmanage the instantiation of virtual machines (e.g., VMs 172) on hosts162 to support such requests. In one embodiment, orchestration component158 instantiates virtual machines according to a requested template thatdefines one or more virtual machines having specified virtual computingresources (e.g., compute, networking, storage resources). Further,orchestration component 158 monitors the infrastructure resourceconsumption levels and requirements of cloud computing environment 170and provides additional infrastructure resources to cloud computingenvironment 170 as needed or desired. In one example, similar tovirtualized computing, system 102, virtualization environment 156 may beimplemented by running on hosts 162 VMware ESX™-based hypervisortechnologies provided by VMware, Inc. of Palo Alto, Calif. (although itshould be recognized that any other virtualization technologies,including Xen® and Microsoft Hyper-V virtualization technologies may beutilized consistent with the teachings herein).

In one embodiment, cloud computing system 150 may include a clouddirector 152 (e.g., run in one or more virtual machines) that managesallocation of virtual computing resources to an enterprise for deployingapplications. Cloud director 152 may be accessible to users via a REST(Representational State Transfer) API (Application ProgrammingInterface) or any other client-server communication protocol. Clouddirector 152 may authenticate connection attempts from the enterpriseusing credentials issued by the cloud computing provider. Cloud director152 maintains and publishes a catalog 166 of available virtual machinetemplates and packaged virtual machine applications that representvirtual machines that may be provisioned in cloud computing environment170. A virtual machine template is a virtual machine image that isloaded with a pre-installed guest operating system, applications, anddata, and is typically used to repeatedly create a VM having thepre-defined configuration. A packaged virtual machine application is alogical container of pre-configured virtual machines having softwarecomponents and parameters that define operational details of thepackaged application. An example of a packaged VM application is vApp™technology made available by VMware, Inc., of Palo Alto, Calif.,although other technologies may be utilized. Cloud director 152 receivesprovisioning requests submitted (e.g., via REST API calls) and maypropagates such requests to orchestration component 158 to instantiatethe requested virtual machines (e.g., VMs 172).

In the embodiment of FIG. 1, cloud computing environment 170 supportsthe creation of a virtual data center 180 having a plurality of virtualmachines 172 instantiated to, for example, host deployed multi-tierapplications. A virtual data center 180 is a logical construct thatprovides compute, network, and storage resources to an organization.Virtual data centers 180 provide an environment where VM 172 can becreated, stored, and operated, enabling complete abstraction between theconsumption of infrastructure service and underlying resources. VMS 172may be configured similarly to VMs 120, as abstractions of processor,memory, storage, and networking resources of hardware resources 160.

Virtual data center 180 includes one or more virtual networks 182 usedto communicate between VMs 172 and managed by at least one networkinggateway component (e.g., gateway 184), as well as one or more isolatedinternal networks 186 not connected to gateway 184. Gateway 184 (e.g.,executing as a virtual appliance) is configured to provide VMs 172 andother components in cloud computing environment 170 with connectivity toexternal network 140 (e.g., Internet). Gateway 184 manages externalpublic IP addresses for virtual data center 180 and one or more privateinternal networks interconnecting VMs 172. Gateway 184 is configured toroute traffic incoming to and outgoing from virtual data center 180 andprovide networking services, such as firewalls, network addresstranslation (NAT), dynamic host configuration protocol (DHCP), and loadbalancing. Gateway 184 may be configured to provide virtual privatenetwork (VPN) connectivity over a network 140 with another VPN endpoint,such as a gateway 124 within virtualized computing system 102. In otherembodiments, gateway 184 may be configured to connect to communicatewith virtualized computing system 102 using a high-throughput, dedicatedlink (depicted as a direct connect 142) between virtualized computingsystem 102 and cloud computing system 150. In one or more embodiments,gateways 124 and 184 are configured to provide a “stretched” layer-2(L2) network that spans virtualized computing system 102 and virtualdata center 180, as shown in FIG. 1.

While FIG. 1 depicts a single connection between on-premise gateway 124and cloud-side gateway 184 for illustration purposes, it should berecognized that multiple connections between multiple on-premisegateways 124 and cloud-side gateways 184 may be used. Furthermore, whileFIG. 1 depicts a single instance of a gateway 184, it is recognized thatgateway 184 may represent multiple gateway components within cloudcomputing system 150. In some embodiments, a separate gateway 184 may bedeployed for each virtual data center, or alternatively, for eachtenant. In some embodiments, a gateway instance may be deployed thatmanages traffic with a specific tenant, while a separate gatewayinstance manages public-facing traffic to the Internet. In yet otherembodiments, one or more gateway instances that are shared among all thetenants of cloud computing system 150 may be used to manage allpublic-facing traffic incoming and outgoing from cloud computing system150.

In one embodiment, each virtual data center 180 includes a “hybridity”director module (depicted as hybridity director 174) configured tocommunicate with the corresponding hybrid cloud manager 132 invirtualized computing system 102 to enable a common virtualizedcomputing platform between virtualized computing system 102 and cloudcomputing system 150. Hybridity director 174 (e.g., executing as avirtual appliance) may communicate with hybrid cloud manager 132 usingInternet-based traffic via a VPN tunnel established between gateways 124and 184, or alternatively, using direct connect 142. In one embodiment,hybridity director 174 may control gateway 184 to control networktraffic into virtual data center 180. In some embodiments, hybriditydirector 174 may control VMs 172 and hosts 162 of cloud computing,system 150 via infrastructure platform 154.

FIG. 2 is a block diagram depicting cross-cloud policy managementoperations of a hybrid cloud computing system 200, according to oneembodiment of the present disclosure. Hybrid cloud computing system 200is configured to provide a common platform for executing virtualworkloads seamlessly between a private data center 202, which mayconfigured similar to virtualized computing system 102, and a publiccloud computing system 250, which may be configured similar to cloudcomputing system 150 in FIG. 1. Private data center 202 may be managedby an enterprise (first organization), and the enterprise may be atenant in public cloud computing system 250, which is managed by a cloudprovider (second organization). For example, a virtual data center 220within public cloud computing system 250 may be allocated to theenterprise as one tenant, while other virtual data centers 222 havingother VMs 224 associated other tenants may be allocated in public cloudcomputing system 250.

During operation, hybrid cloud manager 132 (e.g., in response to userinput) may migrate one or more VMs 120 to virtual data center 220. Insome embodiments, hybrid cloud manager 132 may transfer one or moreexisting virtual computing resources (e.g., VM 208) from private datacenter 202 to virtual data center 220 (the operation being depicted byarrow 230 in FIG. 2). In other embodiments, hybrid cloud manager 132 maysimply deploy additional virtual computing resources, such as VMs,virtual networks, and virtual storage, in virtual data center 220 foruse by a virtual workload. As such, hybridity director 174 instantiateswithin virtual data center 220 a second VM 172 and a virtual network258, which is a component of a stretched network combining with virtualnetwork 214.

Embodiments of the present disclosure provide a mechanism to transferpolicies and configurations for virtual objects in a private data centerto create corresponding policies and configurations in a correspondingvirtual data center in a public cloud computing system. In one or moreembodiments, hybrid cloud manager 132 is configured to determineconfigurations of physical infrastructure of the private data centerthat underlies the virtual machine.

In some embodiments, hybrid cloud manager 132 may discoverconfigurations of the physical infrastructure (e.g., hardwareplatform(s) 106) using a network discovery protocol that may be used toadvertise the identity, capabilities, and neighbors of network devices,such as Link Layer Discovery Protocol. In other embodiments, hybridcloud manager 132 may be query one or more infrastructure manager(s)208, which are management modules (e.g., executing as an appliance) thatprovide infrastructure policies and configurations. Infrastructuremanagers 208 may be configured to connect to virtualization manager 130via a supported extension that centralizes control of infrastructurecomponents within private data center 202. Examples of an infrastructuremanager 208 may be a storage array network (SAN) management module, suchas VMware vSAN, or a virtualized network manager, such as VMware NSX,both made available from VMware, Inc. of Palo Alto, Calif.Infrastructure managers 208 may also be third-party provided components,such as an IT management network appliance that provides DHCP, DNS, andIP address management, such as Infoblox® Grid™ made available byInfoblox of Santa Clara, Calif. Another example of an infrastructuremanager 208 may be a firewall appliance, such as those made available byPalo Alto Networks of Santa Clara, Calif.

FIG. 3 is a flow diagram depicting a method 300 for managing a hybridcloud computing system, according to one embodiment of the presentdisclosure. While method 300 is described in conjunction with componentsof the system shown in FIGS. 1 and 2, other components in computersystems 100 and 200 may perform the steps of method 300, as well asother systems may perform the described method.

Method 300 begins at step 302, hybrid cloud manager 132 receives arequest to migrate a virtual machine from a private data center managedby a first organization enterprise) to a public cloud computing system.The first organization is a tenant in the public cloud computing systemmanaged by a second organization (i.e., cloud provider). In oneembodiment, the request to migrate may be received via user input.

At step 304, hybrid cloud manager 132 determines configurations ofphysical infrastructure of the private data center that underlies thevirtual machine, and/or configurations of the virtual infrastructureassociated with the virtual machine. Configurations of the physicalinfrastructure of the private data center that underlies the virtualmachine may include at least one of network services settings (e.g.,firewall rules), storage settings (e.g., input/output operations persecond, or IOPS; NFS, iSCSI, or FibreChannel connection), and physicalnetwork interface settings (e.g., 1 GB link, 10 GB link, etc.) In someembodiments, hybrid cloud manager 132 discovers the configurations ofthe physical infrastructure using a link layer discovery protocol. Inother embodiments, hybrid cloud manager 132 may query an infrastructuremanager 208 associated with a component of the physical infrastructurefor policies specifying the configurations. In one implementation,hybrid cloud manager 132 may query each infrastructure manager 208 usingan appropriate REST API, netconf, or other interface, such as a CLI(i.e., command script with parsing output).

At step 306, hybrid cloud manager 132 determines a match preferenceassociated with each of the configurations. In some embodiments, hybridcloud manager 132 may present a user interface to a user that lists theplurality of discovered configurations associated with the migrated VM,and provides options to select a match preference for eachconfiguration. Hybrid cloud manager 132 then receives user inputindicating the match preference associated with each of theconfigurations of the physical infrastructure of the private data centerthat underlies the virtual machine.

In one or more embodiments, the match preferences indicate a level ofcriticality for some corresponding configuration at the public cloudsystem. The match preference may be a “must match” indication thatsignifies a second configuration at the public cloud computing systemmust match the first configuration, or a “best match” indication thatsignifies a best match between the first configuration and a secondconfiguration at the public cloud computing system is permitted.

At step 308, hybrid cloud manager 132 generates a package associatedwith the migrated virtual machine. The package may include a metadatafile indicating the configurations and corresponding match preferences.In one implementation, the package may be of a format configured for thepackaging and distribution of virtual machines, such as the OpenVirtualization Format (OVF). In such implementations, the discoveredconfigurations and corresponding match preferences may be stored withina new namespace within one of the metadata files of the OVF file.

At step 310, hybrid cloud manager 132 transmits to public cloudcomputing system 250 the migration package associated with the migratingVM and specifying the determined configurations and corresponding matchpreferences. It is understood that the migration package associated withthe migrating VM may include as part of the package, or be accompaniedby as a separate package, state data of the migrating VM representingthe execution state of the migrating VM.

At step 312, hybridity director 174 receives at public cloud computingsystem 250 the migration package associated with a first virtualmachine. At step 314, hybridity director 174 retrieves a plurality ofconfigurations and corresponding match preferences from the migrationpackages. At step 316 hybridity director 174 determines whether anyconfigurations at public cloud computing system 250 are available basedon the corresponding match preferences.

If so, at step 318, hybridity director 174 instantiates a (second) VM172 within virtual data center 220 based on the migration package. Theinstantiated second VM 172 in virtual data center 220 corresponds to themigrated virtual machine in private data center 202. Hybridity director174 may generate one or more configurations within public cloudcomputing system 250 using those matching configurations. That is,hybridity director 174 sets up a configuration within public cloudcomputing system 250 similar to that found within private data center202, thereby providing a seamless transition between private data center202 and public cloud computing system 250.

In one embodiment, for each configuration having a “best match” matchpreference specified in the migration package, hybridity director 174identifies which configuration/policy providing is most similar to thesettings of private data center 202 (e.g., network settings, storagesettings). In some embodiments, the matching between configurations inprivate data center and public cloud computing system may bepre-determined. In another embodiment, for each configuration having a“must match” preference, hybridity director 174 identifies aconfiguration/policy within public cloud computing system 250 havingproviding substantially similar settings as the private data centerconfiguration. If no such policy is available within public cloudcomputing system 250, hybridity director 174 may terminate the VMmigration process and report an error back to hybrid cloud manager 132.

Certain embodiments as described above involve a hardware abstractionlayer on top of a host computer. The hardware abstraction layer allowsmultiple contexts to share the hardware resource. In one embodiment,these contexts are isolated from each other, each having at least a userapplication running therein. The hardware abstraction layer thusprovides benefits of resource isolation and allocation among thecontexts. In the foregoing embodiments, virtual machines are used as anexample for the contexts and hypervisors as an example for the hardwareabstraction layer. As described above, each virtual machine includes aguest operating system in which at least one application runs. It shouldbe noted that these embodiments may also apply to other examples ofcontexts, such as containers not including a guest operating system,referred to herein as “OS-less containers” (see, e.g., www.docker.com).OS-less containers implement operating system-level virtualizationwherein an abstraction layer is provided on top of the kernel of anoperating system on a host computer. The abstraction layer supportsmultiple OS-less containers each including an application and itsdependencies. Each OS-less container runs as an isolated process inuserspace on the host operating system and shares the kernel with othercontainers. The OS-less container relies on the kernel's functionalityto make use of resource isolation (CPU, memory, block I/O, network,etc.) and separate namespaces and to completely isolate theapplication's view of the operating environments. By using OS-lesscontainers, resources can be isolated, services restricted, andprocesses provisioned to have a private view of the operating systemwith their own process ID space, file system structure, and networkinterfaces. Multiple containers can share the same kernel, but eachcontainer can be constrained to only use a defined amount of resourcessuch as CPU, memory and I/O. As used herein, the term “container” refersgenerically to both virtual machines and OS-less containers.

Although one or more embodiments have been described herein in somedetail for clarity of understanding, it should be recognized thatcertain changes and modifications may be made without departing from thespirit of the disclosure. The various embodiments described herein mayemploy various computer-implemented operations involving data stored incomputer systems. For example, these operations may require physicalmanipulation of physical quantities—usually, though not necessarily,these quantities may take the form of electrical or magnetic signals,where they or representations of them are capable of being stored,transferred, combined, compared, or otherwise manipulated. Further, suchmanipulations are often referred to in terms, such as producing,yielding, identifying, determining, or comparing. Any operationsdescribed herein that form part of one or more embodiments of thedisclosure may be useful machine operations. In addition, one or moreembodiments of the disclosure also relate to a device or an apparatusfor performing these operations. The apparatus may be speciallyconstructed for specific required purposes, or it may be a generalpurpose computer selectively activated or configured by a computerprogram stored in the computer. In particular, various general purposemachines may be used with computer programs written in accordance withthe teachings herein, or it may be more convenient to construct a morespecialized apparatus to perform the required operations.

The various embodiments described herein may be practiced with othercomputer system configurations including hand-held devices,microprocessor systems, microprocessor-based or programmable consumerelectronics, minicomputers, mainframe computers, and the like.

One or more embodiments of the present disclosure may be implemented asone or more computer programs or as one or more computer program modulesembodied in one or more computer readable media. The term computerreadable medium refers to any data storage device that can store datawhich can thereafter be input to a computer system—computer readablemedia may be based on any existing or subsequently developed technologyfor embodying computer programs in a manner that enables them to be readby a computer. Examples of a computer readable medium include a harddrive, network attached storage (NAS), read-only memory, random-accessmemory (e.g., a flash memory device), a CD (Compact Discs)—CD-ROM, aCD-R, or a CD-RW, a DVD (Digital Versatile Disc), a magnetic tape, andother optical and non-optical data storage devices. The computerreadable medium can also be distributed over a network coupled computersystem so that the computer readable code is stored and executed in adistributed fashion.

Although one or more embodiments of the present disclosure have beendescribed in some detail for clarity of understanding, it will beapparent that certain changes and modifications may be made within thescope of the claims. Accordingly, the described embodiments are to beconsidered as illustrative and not restrictive, and the scope of theclaims is not to be limited to details given herein, but may be modifiedwithin the scope and equivalents of the claims. In the claims, elementsand/or steps do not imply any particular order of operation, unlessexplicitly stated in the claims.

Many variations, modifications, additions, and improvements arepossible. Plural instances may be provided for components, operations orstructures described herein as a single instance. Boundaries betweenvarious components, operations and data stores are somewhat arbitrary,and particular operations are illustrated in the context of specificillustrative configurations. Other allocations of functionality areenvisioned and may fall within the scope of the disclosure(s). Ingeneral, structures and functionality presented as separate componentsin exemplary configurations may be implemented as a combined structureor component. Similarly, structures and functionality presented as asingle component may be implemented as separate components. These andother variations, modifications, additions, and improvements may fallwithin the scope of the appended claim(s).

What is claimed is:
 1. A method for managing a hybrid cloud computingsystem, the method comprising: at a hybrid cloud manager of a privatedata center of the hybrid cloud computing system, receiving a request tomigrate a virtual machine from the private data center managed by afirst organization to a public cloud computing system of the hybridcloud computing system, wherein the first organization is a tenant inthe public cloud computing system managed by a second organization; atthe hybrid cloud manager of the private data center, determiningconfigurations of physical infrastructure of the private data centerthat underlies the virtual machine, wherein the configurations of thephysical infrastructure of the private data center that underlies thevirtual machine comprise: network services settings that includefirewall rules; storage settings that include input/output operationsper second or a particular storage type; and physical network interfacesettings that include a link of a particular transmission rate; usingthe hybrid cloud manager of the private data center, presenting a userinterface, which lists the configurations of the physical infrastructureof the private data center that underlies the virtual machine andprovides options to select a match preference for each of theconfigurations, to a user; at the hybrid cloud manager of the privatedata center, receiving user input from the user indicating the matchpreference for each of the configurations of the physical infrastructureof the private data center that underlies the virtual machine; and fromthe hybrid cloud manager of the private data center, transmitting, tothe public cloud computing system, a migration package associated withthe virtual machine and specifying the determined configurations andcorresponding match preferences and state data of the virtual machinerepresenting an execution state of the virtual machine.
 2. The method ofclaim 1, wherein the determining the configurations of physicalinfrastructure of the private data center that underlies the virtualmachines further comprises: discovering the configurations of thephysical infrastructure using a link layer discovery protocol.
 3. Themethod of claim 1, wherein the determining the configurations ofphysical infrastructure of the private data center that underlies thevirtual machines further comprises: querying an infrastructure managerassociated with a component of the physical infrastructure for policiesspecifying the configurations.
 4. The method of claim 1, furthercomprising: generating the migration package associated with the virtualmachine, wherein the migration package comprises a metadata fileindicating the configurations and corresponding match preferences.
 5. Anon-transitory computer-readable storage medium comprising instructionsthat, when executed in a computing device, manage a hybrid cloudcomputing system, by performing the steps of: at a hybrid cloud managerof a private data center of the hybrid cloud computing system, receivinga request to migrate a virtual machine from the private data centermanaged by a first organization to a public cloud computing system ofthe hybrid cloud computing system, wherein the first organization is atenant in the public cloud computing system managed by a secondorganization; at the hybrid cloud manager of the private data center,determining configurations of physical infrastructure of the privatedata center that underlies the virtual machine, wherein theconfigurations of the physical infrastructure of the private data centerthat underlies the virtual machine comprise: network services settingsthat include firewall rules; storage settings that include input/outputoperations per second or a particular storage type; and physical networkinterface settings that include a link of a particular transmissionrate; using the hybrid cloud manager of the private data center,presenting a user interface, which lists the configurations of thephysical infrastructure of the private data center that underlies thevirtual machine and provides options to select a match preference foreach of the configurations, to a user; at the hybrid cloud manager ofthe private data center, receiving user input from the user indicatingthe match preference for each of the configurations of the physicalinfrastructure of the private data center that underlies the virtualmachine; and from the hybrid cloud manager of the private data center,transmitting, to the public cloud computing system, a migration packageassociated with the virtual machine and specifying the determinedconfigurations and corresponding match preferences and state data of thevirtual machine representing an execution state of the virtual machine.6. The non-transitory computer-readable storage medium of claim 5,wherein the determining the configurations of physical infrastructure ofthe private data center that underlies the virtual machines furthercomprises: discovering the configurations of the physical infrastructureusing a link layer discovery protocol.
 7. The non-transitorycomputer-readable storage medium of claim 5, wherein the determining theconfigurations of physical infrastructure of the private data centerthat underlies the virtual machines further comprises: querying aninfrastructure manager associated with a component of the physicalinfrastructure for policies specifying the configurations.
 8. Thenon-transitory computer-readable storage medium of claim 5, wherein thesteps further comprise: generating the migration package associated withthe virtual machine, wherein the migration package comprises a metadatafile indicating the configurations and corresponding match preferences.9. A system comprising: memory; and one or more processors configuredto: at a hybrid cloud manager of a private data center of a hybrid cloudcomputing system, receive a request to migrate a virtual machine fromthe private data center managed by a first organization to a publiccloud computing system of the hybrid cloud computing system, wherein thefirst organization is a tenant in the public cloud computing systemmanaged by a second organization; at the hybrid cloud manager of theprivate data center, determine configurations of physical infrastructureof the private data center that underlies the virtual machine, whereinthe configurations of the physical infrastructure of the private datacenter that underlies the virtual machine comprise: network servicessettings that include firewall rules; storage settings that includeinput/output operations per second or a particular storage type; andphysical network interface settings that include a link of a particulartransmission rate; using the hybrid cloud manager of the private datacenter, present a user interface, which lists the configurations of thephysical infrastructure of the private data center that underlies thevirtual machine and provides options to select a match preference foreach of the configurations, to a user; at the hybrid cloud manager ofthe private data center, receive user input from the user indicating thematch preference for each of the configurations of the physicalinfrastructure of the private data center that underlies the virtualmachine; and from the hybrid cloud manager of the private data center,transmit, to the public cloud computing system, a migration packageassociated with the virtual machine and specifying the determinedconfigurations and corresponding match preferences and state data of thevirtual machine representing an execution state of the virtual machine.10. The system of claim 9, wherein the one or more processors arefurther configured to: discover the configurations of the physicalinfrastructure using a link layer discovery protocol.
 11. The system ofclaim 9, wherein the one or more processors are further configured to:query an infrastructure manager associated with a component of thephysical infrastructure for policies specifying the configurations. 12.The system of claim 9, wherein the one or more processors are furtherconfigured to: generate the migration package associated with thevirtual machine, wherein the migration package comprises a metadata fileindicating the configurations and corresponding match preferences.